My question is how you deploy Reporting Services in a Production Environment. Do you have a server for development and one for production. If you do that how do you prevent groups of users from accessing reports that they should not view.

Can you deploy reports as part of a release of an executable and so not deploy it via the web?

First you have to deploy the solution to the report server. Once there, you can connect to the report manager and click on the report. There is a properties tab there that will let you choose Active Directory groups allowing access or denying access. This is discussed in the SQL reporting services books online.